CVE-2009-1841

Published: Jun 12, 2009Modified: Apr 23, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

js/src/xpconnect/src/xpcwrappedjsclass.cpp in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to execute arbitrary web script with the privileges of a chrome object, as demonstrated by the browser sidebar and the FeedWriter.

Affected (202)

Products: Mozilla: Firefox, Seamonkey, Thunderbird

3 products

Configuration A

202 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 3.0.10
Mozilla Firefox	Version 0.10.1
Mozilla Firefox	Version 0.10
Mozilla Firefox	Version 0.1
Mozilla Firefox	Version 0.2
Mozilla Firefox	Version 0.3
Mozilla Firefox	Version 0.4
Mozilla Firefox	Version 0.5
Mozilla Firefox	Version 0.6.1
Mozilla Firefox	Version 0.6
Mozilla Firefox	Version 0.7.1
Mozilla Firefox	Version 0.7
Mozilla Firefox	Version 0.8
Mozilla Firefox	Version 0.9.1
Mozilla Firefox	Version 0.9.2
Mozilla Firefox	Version 0.9.3
Mozilla Firefox	Version 0.9
Mozilla Firefox	Version 0.9 rc
Mozilla Firefox	Version 0.9_rc
Mozilla Firefox	Version 1.0.1
Mozilla Firefox	Version 1.0.2
Mozilla Firefox	Version 1.0.3
Mozilla Firefox	Version 1.0.4
Mozilla Firefox	Version 1.0.5
Mozilla Firefox	Version 1.0.6
Mozilla Firefox	Version 1.0.6
Mozilla Firefox	Version 1.0.7
Mozilla Firefox	Version 1.0.8
Mozilla Firefox	Version 1.0
Mozilla Firefox	Version 1.0 preview_release
Mozilla Firefox	Version 1.4.1
Mozilla Firefox	Version 1.5.0.10
Mozilla Firefox	Version 1.5.0.11
Mozilla Firefox	Version 1.5.0.12
Mozilla Firefox	Version 1.5.0.1
Mozilla Firefox	Version 1.5.0.2
Mozilla Firefox	Version 1.5.0.3
Mozilla Firefox	Version 1.5.0.4
Mozilla Firefox	Version 1.5.0.5
Mozilla Firefox	Version 1.5.0.6
Mozilla Firefox	Version 1.5.0.7
Mozilla Firefox	Version 1.5.0.8
Mozilla Firefox	Version 1.5.0.9
Mozilla Firefox	Version 1.5.1
Mozilla Firefox	Version 1.5.2
Mozilla Firefox	Version 1.5.3
Mozilla Firefox	Version 1.5.4
Mozilla Firefox	Version 1.5.5
Mozilla Firefox	Version 1.5.6
Mozilla Firefox	Version 1.5.7
Mozilla Firefox	Version 1.5.8
Mozilla Firefox	Version 1.5
Mozilla Firefox	Version 1.5 beta1
Mozilla Firefox	Version 1.5 beta2
Mozilla Firefox	Version 1.8
Mozilla Firefox	Version 2.0.0.10
Mozilla Firefox	Version 2.0.0.11
Mozilla Firefox	Version 2.0.0.12
Mozilla Firefox	Version 2.0.0.13
Mozilla Firefox	Version 2.0.0.14
Mozilla Firefox	Version 2.0.0.15
Mozilla Firefox	Version 2.0.0.16
Mozilla Firefox	Version 2.0.0.17
Mozilla Firefox	Version 2.0.0.18
Mozilla Firefox	Version 2.0.0.19
Mozilla Firefox	Version 2.0.0.1
Mozilla Firefox	Version 2.0.0.20
Mozilla Firefox	Version 2.0.0.21
Mozilla Firefox	Version 2.0.0.2
Mozilla Firefox	Version 2.0.0.3
Mozilla Firefox	Version 2.0.0.4
Mozilla Firefox	Version 2.0.0.5
Mozilla Firefox	Version 2.0.0.6
Mozilla Firefox	Version 2.0.0.7
Mozilla Firefox	Version 2.0.0.8
Mozilla Firefox	Version 2.0.0.9
Mozilla Firefox	Version 2.0
Mozilla Firefox	Version 2.0 beta1
Mozilla Firefox	Version 2.0 beta_1
Mozilla Firefox	Version 2.0 rc2
Mozilla Firefox	Version 2.0 rc3
Mozilla Firefox	Version 2.0_.10
Mozilla Firefox	Version 2.0_.1
Mozilla Firefox	Version 2.0_.4
Mozilla Firefox	Version 2.0_.5
Mozilla Firefox	Version 2.0_.6
Mozilla Firefox	Version 2.0_.7
Mozilla Firefox	Version 2.0_.9
Mozilla Firefox	Version 2.0_8
Mozilla Firefox	Version 3.0.1
Mozilla Firefox	Version 3.0.2
Mozilla Firefox	Version 3.0.3
Mozilla Firefox	Version 3.0.4
Mozilla Firefox	Version 3.0.5
Mozilla Firefox	Version 3.0.6
Mozilla Firefox	Version 3.0.7
Mozilla Firefox	Version 3.0.8
Mozilla Firefox	Version 3.0.9
Mozilla Firefox	Version 3.0
Mozilla Firefox	Version 3.0 alpha
Mozilla Firefox	Version 3.0 beta2
Mozilla Firefox	Version 3.0 beta5
Mozilla Firefox	Version 3.0beta5
Mozilla Seamonkey	Up to 1.1.16
Mozilla Seamonkey	Version 1.0.1
Mozilla Seamonkey	Version 1.0.3
Mozilla Seamonkey	Version 1.0.4
Mozilla Seamonkey	Version 1.0.6
Mozilla Seamonkey	Version 1.0.8
Mozilla Seamonkey	Version 1.0.99
Mozilla Seamonkey	Version 1.0.9
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0 alpha
Mozilla Seamonkey	Version 1.0 beta
Mozilla Seamonkey	Version 1.1.10
Mozilla Seamonkey	Version 1.1.11
Mozilla Seamonkey	Version 1.1.12
Mozilla Seamonkey	Version 1.1.13
Mozilla Seamonkey	Version 1.1.15
Mozilla Seamonkey	Version 1.1.1
Mozilla Seamonkey	Version 1.1.3
Mozilla Seamonkey	Version 1.1.5
Mozilla Seamonkey	Version 1.1.5 1.1.10
Mozilla Seamonkey	Version 1.1.6
Mozilla Seamonkey	Version 1.1.7
Mozilla Seamonkey	Version 1.1.8
Mozilla Seamonkey	Version 1.1.9
Mozilla Seamonkey	Version 1.1
Mozilla Seamonkey	Version 1.1 alpha
Mozilla Seamonkey	Version 1.1 beta
Mozilla Thunderbird	Up to 2.0.0.19
Mozilla Thunderbird	Version 0.1
Mozilla Thunderbird	Version 0.2
Mozilla Thunderbird	Version 0.3
Mozilla Thunderbird	Version 0.4
Mozilla Thunderbird	Version 0.5
Mozilla Thunderbird	Version 0.6
Mozilla Thunderbird	Version 0.7.1
Mozilla Thunderbird	Version 0.7.2
Mozilla Thunderbird	Version 0.7.3
Mozilla Thunderbird	Version 0.7
Mozilla Thunderbird	Version 0.8
Mozilla Thunderbird	Version 0.9
Mozilla Thunderbird	Version 1.0.1
Mozilla Thunderbird	Version 1.0.2
Mozilla Thunderbird	Version 1.0.3
Mozilla Thunderbird	Version 1.0.4
Mozilla Thunderbird	Version 1.0.5
Mozilla Thunderbird	Version 1.0.5 beta
Mozilla Thunderbird	Version 1.0.6
Mozilla Thunderbird	Version 1.0.7
Mozilla Thunderbird	Version 1.0.8
Mozilla Thunderbird	Version 1.0
Mozilla Thunderbird	Version 1.5.0.10
Mozilla Thunderbird	Version 1.5.0.11
Mozilla Thunderbird	Version 1.5.0.12
Mozilla Thunderbird	Version 1.5.0.13
Mozilla Thunderbird	Version 1.5.0.14
Mozilla Thunderbird	Version 1.5.0.1
Mozilla Thunderbird	Version 1.5.0.2
Mozilla Thunderbird	Version 1.5.0.3
Mozilla Thunderbird	Version 1.5.0.4
Mozilla Thunderbird	Version 1.5.0.5
Mozilla Thunderbird	Version 1.5.0.6
Mozilla Thunderbird	Version 1.5.0.7
Mozilla Thunderbird	Version 1.5.0.8
Mozilla Thunderbird	Version 1.5.0.9
Mozilla Thunderbird	Version 1.5.1
Mozilla Thunderbird	Version 1.5.2
Mozilla Thunderbird	Version 1.5
Mozilla Thunderbird	Version 1.5 beta2
Mozilla Thunderbird	Version 1.7.1
Mozilla Thunderbird	Version 1.7.3
Mozilla Thunderbird	Version 2.0.0.0
Mozilla Thunderbird	Version 2.0.0.11
Mozilla Thunderbird	Version 2.0.0.12
Mozilla Thunderbird	Version 2.0.0.13
Mozilla Thunderbird	Version 2.0.0.14
Mozilla Thunderbird	Version 2.0.0.15
Mozilla Thunderbird	Version 2.0.0.16
Mozilla Thunderbird	Version 2.0.0.17
Mozilla Thunderbird	Version 2.0.0.18
Mozilla Thunderbird	Version 2.0.0.1
Mozilla Thunderbird	Version 2.0.0.2
Mozilla Thunderbird	Version 2.0.0.3
Mozilla Thunderbird	Version 2.0.0.4
Mozilla Thunderbird	Version 2.0.0.5
Mozilla Thunderbird	Version 2.0.0.6
Mozilla Thunderbird	Version 2.0.0.7
Mozilla Thunderbird	Version 2.0.0.8
Mozilla Thunderbird	Version 2.0.0.9
Mozilla Thunderbird	Version 2.0_.12
Mozilla Thunderbird	Version 2.0_.13
Mozilla Thunderbird	Version 2.0_.14
Mozilla Thunderbird	Version 2.0_.4
Mozilla Thunderbird	Version 2.0_.5
Mozilla Thunderbird	Version 2.0_.6
Mozilla Thunderbird	Version 2.0_.9
Mozilla Thunderbird	Version 2.0_8

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (68)

http://osvdb.org/55159

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2009-1096.html

Source: secalert@redhat.com

http://secunia.com/advisories/35331

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/35415

Source: secalert@redhat.com

http://secunia.com/advisories/35428

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/35431

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/35439

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/35440

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/35468

Source: secalert@redhat.com

http://secunia.com/advisories/35536

Source: secalert@redhat.com

http://secunia.com/advisories/35561

Source: secalert@redhat.com

http://secunia.com/advisories/35602

Source: secalert@redhat.com

http://secunia.com/advisories/35882

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.372468

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.425408

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1

Source: secalert@redhat.com

http://www.debian.org/security/2009/dsa-1820

Source: secalert@redhat.com

http://www.debian.org/security/2009/dsa-1830

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2009:141

Source: secalert@redhat.com

http://www.mozilla.org/security/announce/2009/mfsa2009-32.html

Source: secalert@redhat.com

Vendor Advisory

http://www.securityfocus.com/bid/35326

Source: secalert@redhat.com

http://www.securityfocus.com/bid/35373

Source: secalert@redhat.com

http://www.securitytracker.com/id?1022397

Source: secalert@redhat.com

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.454275

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-782-1

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/1572

Source: secalert@redhat.com

PatchVendor Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=479560

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=503583

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9815

Source: secalert@redhat.com

https://rhn.redhat.com/errata/RHSA-2009-1095.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00444.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00504.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00574.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00657.html

Source: secalert@redhat.com

http://osvdb.org/55159